CrocoBlock vulnerabilities and threats

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Code Injection.This issue affects JetFormBuilder: from n/a through 3.6.8.

Authorization Bypass Through User-Controlled Key vulnerability in CrocoBlock JetFormBuilder – Hierarchical Select jet-form-builder-hierarchical-select allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetFormBuilder – Hierarchical Select: from n/a through 1.0.10.

CVE-2026-123483 is a medium severity vulnerability in Crocoblock JetFormBuilder versions prior to 3.6.8.1. It involves improper neutralization of script-related HTML tags, leading to a basic cross-site scripting (XSS) issue that allows code injection. The vulnerability affects versions from initial releases up to 3.6.8. The issue has been fixed in version 3.6.8.1.

CVE-2026-123477 is a stored cross-site scripting (XSS) vulnerability in Crocoblock JetEngine versions before 3.9.1. It arises from improper neutralization of input during web page generation, allowing attackers with limited privileges to inject malicious scripts. The vulnerability affects JetEngine versions from initial releases up to 3.9.0.2 and has been assigned a medium severity rating with a CVSS score of 6.5. A fix is available in version 3.9.1.

Incorrect Privilege Assignment vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Privilege Escalation.This issue affects JetFormBuilder: from n/a through 3.6.7.1.

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Path Traversal.This issue affects JetFormBuilder: from n/a through 3.6.7.1.

CVE-2026-119479 is a medium severity vulnerability in Crocoblock JetFormBuilder versions prior to 3.6.8. It involves improper neutralization of script-related HTML tags, leading to a basic cross-site scripting (XSS) issue that allows code injection. The vulnerability affects all versions from initial releases up to 3.6.7.1 and has been fixed in version 3.6.8.

CVE-2026-119482 is a missing authorization vulnerability in Crocoblock JetFormBuilder versions prior to 3.6.8. This flaw allows unauthorized users to exploit incorrectly configured access control security levels, potentially leading to unauthorized modification of data. The issue affects all versions from initial releases up to 3.6.7.1 and has been assigned a medium severity rating with a CVSS score of 5.3. A fix is available in version 3.6.8.

CVE-2026-39737 is a stored cross-site scripting (XSS) vulnerability in Crocoblock JetElements For Elementor plugin versions before 2.9.2.7. The flaw allows improper neutralization of input during web page generation, potentially enabling attackers to inject malicious scripts. This vulnerability has a medium severity rating with a CVSS score of 6.5. A fixed version, 2.9.2.7, is available to address this issue.

CVE-2026-39736 is a SQL Injection vulnerability in Crocoblock JetEngine versions prior to 3.9.0.2. It allows an attacker with low privileges to execute SQL commands due to improper neutralization of special elements in SQL queries. The vulnerability has a high severity with a CVSS score of 8.5. A fix is available in version 3.9.0.2.

CVE-2026-116857 is a stored cross-site scripting (XSS) vulnerability in Crocoblock's JetSmartFilters plugin versions before 3.8.6.3. It allows improper neutralization of input during web page generation, potentially enabling attackers to inject malicious scripts. The issue affects all versions from initial releases up to 3.8.6.2. A fix is available in version 3.8.6.3.

CVE-2026-39735 is a missing authorization vulnerability in Crocoblock JetEngine versions prior to 3.9.0.2. It allows exploitation due to incorrectly configured access control security levels. The vulnerability has a CVSS score of 6.5, indicating a medium severity impact primarily affecting confidentiality. A fix is available in version 3.9.0.2.

CVE-2026-114708 is a stored cross-site scripting (XSS) vulnerability in Crocoblock JetSmartFilters versions before 3.8.6.2. It arises from improper neutralization of input during web page generation, allowing attackers with low privileges to inject malicious scripts. The flaw is fixed in version 3.8.6.2.

CVE-2026-114707 is a stored cross-site scripting (XSS) vulnerability in Crocoblock JetElements For Elementor versions prior to 2.9.2.6. The flaw involves improper neutralization of input during web page generation, which could allow an attacker with limited privileges to execute malicious scripts in the context of the affected application. This vulnerability has a medium severity rating with a CVSS score of 6.5. A fixed version, 2.9.2.6, is available to address this issue.

Crocoblock JetEngine versions prior to 3.9.0.1 contain an SQL Injection vulnerability due to improper neutralization of special elements in SQL commands. This flaw allows an attacker with low privileges to execute unauthorized SQL commands, potentially leading to high confidentiality impact and limited availability impact. The issue is fixed in version 3.9.0.1.

CVE-2026-111414 is a stored cross-site scripting (XSS) vulnerability in Crocoblock JetElements For Elementor versions before 2.9.2.5. It allows improper neutralization of input during web page generation, potentially enabling attackers to inject malicious scripts. The issue affects all versions from initial release up to 2.9.2.4 and has been fixed in version 2.9.2.5.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetSmartFilters jet-smart-filters allows Stored XSS.This issue affects JetSmartFilters: from n/a through 3.8.6.

CVE-2026-107870 is a high-severity Cross-site Scripting (XSS) vulnerability in Crocoblock JetEngine. It involves improper neutralization of input during web page generation, leading to a DOM-based XSS issue. This affects JetEngine versions from the initial release up to 3.8.16. The vulnerability allows an attacker to execute malicious scripts in the context of the affected web application, potentially impacting confidentiality, integrity, and availability.

CVE-2026-107867 is a reflected cross-site scripting (XSS) vulnerability in Crocoblock JetProductTables plugin versions up to 1.2.4. This flaw allows improper neutralization of input during web page generation, potentially enabling attackers to execute arbitrary scripts in the context of the affected web application. The vulnerability has a high severity rating with a CVSS score of 7.1.

CVE-2026-107431 is a missing authorization vulnerability in Crocoblock JetFormBuilder affecting versions from initial releases up to 3.6.6. This flaw allows unauthorized users to exploit incorrectly configured access control security levels, potentially causing denial of service. The vulnerability has a high severity rating with a CVSS score of 7.5. No official patch or remediation details are provided in the available data.